Security
How Belayr protects the people on it, what it runs on, and what is not in place yet. Written for a brokerage doing its homework, and for anybody deciding whether to trust Belayr with where they are.
The wall between agents and their brokerage
- A brokerage's desk sees that a showing is armed, the address the agent entered and the clock. It sees where the agent is only if that timer fires.
- It never sees a walk home or any other personal timer, and never the route of a showing that ended fine. Those routes are deleted after seven days by the same scheduled job that keeps storage in check, so it has to run.
- Every time somebody on a desk opens the details of an alert or prints them for the police, it is recorded, and the agent can see who looked.
Protecting the person under pressure
- A wrong safe word looks exactly like a right one on the agent's own screen, and alerts their contacts. Belayr is built and tested so that nothing it shows the agent, or answers their phone, differs between the two.
- The safe word is never shown back inside the app. It is stored encrypted, with a key kept in Azure Key Vault rather than in the code or the database.
Accounts and signing in
- Sign-in tokens and recovery codes are stored only as SHA-256 hashes, never as the codes themselves.
- Passwords are hashed with PBKDF2-SHA256 at 600,000 rounds. Repeated wrong guesses for one email are made to wait longer each time.
- Every place an account is signed in is listed in its Settings, and any of them but the phone it was set up on can be signed out in one tap.
- Belayr emails an account only once its owner has confirmed the address, by typing a code sent to it into a device already signed in, so a mistyped address cannot be used to take the account.
- Only the device an account was set up on can change its email, and a confirmed old address is told when it changes.
- Setting or changing a password emails the account. Setting one with an emailed link is also announced on the owner's own devices, because the person reading that email may not be the owner.
Data in transit and at rest
- Everything is served over HTTPS, and browsers are told to use nothing else for a year.
- The database is Azure SQL, which encrypts data at rest. The app reaches it with a managed identity, so no database password exists to leak.
- Other secrets, such as the keys for texts and email, live in Azure Key Vault.
- Photos are shrunk on the phone before they are sent, which strips the location your camera writes into the file, and the server accepts them only if their contents really are an image.
What Belayr does not have
- No advertising, no analytics trackers and no third-party marketing tools.
- Nobody at Belayr needs, or has a screen for, reading anybody's route. The operations view counts alerts and failed deliveries; it does not show where anybody went.
Where it runs, today
Belayr is in beta, and this section says so plainly. It runs as a single instance in Microsoft Azure in the United States, with no second copy standing by. An independent check outside Azure tests every five minutes that the scheduler behind the timers is running and on time, and emails us if not. The database is backed up automatically and can be restored to any moment in the past seven days, and a full restore was tested on September 28, 2026. There is no uptime commitment yet, and Belayr has not been through a SOC 2 or similar audit.
Who else touches the data
- Twilio delivers text messages.
- Resend sends Belayr's email.
- Microsoft Azure hosts the service and its database, in the United States.
What each one receives is in the Privacy Policy.
Reporting a problem
If you find a security issue, email support@belayr.io. Please do not test against other people's accounts or alerts. We read every report and will tell you what we did about it.